How to connect an Amazon S3 bucket

For teams with their own infrastructure, Inwista can deliver transcripts and rendered videos directly into an S3 bucket — ideal for feeding archives, media pipelines or downstream processing. The connection uses scoped IAM credentials that you control, verified against the bucket before anything is stored.

What you'll need

• An S3 bucket In any AWS region. One constraint: bucket names containing dots are not supported (they break TLS certificate validation with virtual-hosted-style requests).
• A scoped IAM user Create a dedicated IAM user with programmatic access, limited to this bucket. The policy only needs s3:PutObject and s3:ListBucket on the bucket and its objects — nothing account-wide.
• Inwista administrator + subscription Integrations are managed by workspace administrators and included in every paid plan.

Connect the bucket

In My workspace → Integrations, click Connect on the Amazon S3 card and fill in the four fields: Access key ID, Secret access key, Region (for example eu-north-1) and Bucket.

Inwista validates the credentials immediately by performing a signed ListObjectsV2 request against the bucket — if the keys, region and bucket don't line up, the connection fails right there instead of at your first delivery. Once verified, the credentials are stored encrypted at rest.

How objects are laid out

Deliveries are written under a Inwista/ prefix by default, with one prefix per project: Inwista/{project name}/ holds the current files, and Inwista/{project name}/revisions/ accumulates a timestamped copy per delivery when Keep delivery history is enabled. Current files are overwritten by key on re-delivery, so consumers reading a fixed key always get the latest version.

Transcript formats (SRT, VTT, TTML, DOCX and more) and the file name template are configurable under Manage — the template supports project name, date and language variables.

Automating deliveries

Enable Deliver new transcripts automatically and/or Deliver video exports automatically in the integration settings to push output to the bucket the moment it's produced — useful when S3 is the handoff point to another system. Individual exports can also target S3 ad hoc via the Save to selector in the export dialog.

Note that S3 is a delivery destination only: importing source media into Inwista happens via upload or the consumer cloud integrations.

Disconnecting and key rotation

Disconnect from the Manage view at any time — objects already in the bucket are never touched. To rotate credentials, generate new keys in IAM, then reconnect the integration with the new pair and deactivate the old keys in AWS. If you ever suspect a leak, deactivating the IAM keys in AWS kills the connection instantly regardless of what's stored in Inwista.